CVE-2026-59284 Spring Cloud Commons no allow list for writable env actuator endpoint

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier...

CVE-2026-59284

Spring Cloud Commons lacks an allow list for property keys when the writable /actuator/env endpoint is enabled. Affected versions include 5.0.0–5.0.2 , 4.3.0–4.3.3 , 4.0.0–4.2.6 , and 3.1.10 and earlier . The vulnerability requires high privileges (CVSS 3.1: 7.6 HIGH , scope changed) and can lead...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the env actuator endpoint when no allow list is enforced for property keys. An attacker can modify arbitrary environment properties by sending crafted requests to the writable endpoint. Note: This is only...